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IN THE CLAIMS 
Amended Claims follow: 

(Previously Amended) A method for processing network accounting 
information, comprising: 

receiving accounting information over a packet-switched network; 
monitoring at least one aspect of the received accounting information; and 
discarding at least a portion of the accounting information that occurs during 
a surge in network traffic, based on the monitored aspect. 

2. (Original) The method as recited in claim 1, wherein the accounting 
information is discarded for providing a defense against network attacks. 

3. (Original) The method as recited in claim 1, wherein the accounting 
information is discarded for dealing with heavy network traffic. 

4. (Original) The method as recited in claim 3, and further comprising 
generating a summary of the accounting information. 

5. (Original) The method as recited in claim 1, wherein monitoring the at least 
one aspect of the received accounting information includes detecting a scan 
of a plurality of ports. 

6. (Original) The method as recited in claim 1, wherein monitoring the at least 
one aspect of the received accounting information includes detecting a scan 
of a plurality of Internet Protocol (IP) addresses. 

7. (Original) The method as recited in claim 1, wherein monitoring the at least 
one aspect of the received accounting information includes monitoring a Tate 
of receipt of the accounting information. 



(a) 
(b) 
(c) 



PAGE 7/14 * RCVD AT 3H2/2004 7:44:31 PM [Eastern Standard Time] * SVR:USPTO-EFXRF-1/3 * DNIS: 8729306 * CSIDM08 971 4660 * DURATION (mm-ss):04-16 



Mar 22 04 04:53p 



SV I 



• 



408 971 4660 



p. 8 



-3- 



8. (Original) The method as recited in claim 7, wherein monitoring the at least 
one aspect of the received accounting information includes detecting whether 
the rate of receipt of the accounting information exceeds a predetermined 
amount. 

9. (Original) The method as recited in claim 1 , wherein monitoring the at least 
one aspect of the received accounting information includes monitoring a load 
on a system receiving the accounting information. 

10. (Original) The method as recited in claim 1, wherein the network includes 
the Internet. 

1 1 . (Previously Amended) A computer program product for processing network 
accounting information, comprising: 

(a) computer code for receiving accounting information over a packet-switched 
network;- - - 

(b) computer code for monitoring at least one aspect of the received accounting 
information; and 

(c) computer code for discarding at least a portion of the accounting information 
that occurs during a surge in network traffic, based on the monitored aspect. 

12. (Original) The computer program product as recited in claim 1 1 , wherein the 
accounting information is discarded for providing a defense against network 
attacks. 

13. (Original) The computer program product as recited in claim 1 1 , wherein the 
accounting information is discarded for dealing with heavy network traffic. 

1 4. (Original) The computer program product as recited in claim 13, and further 
comprising computer code for generating a summary of the accounting 
information. 
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15. (Original) The computer program product as recited in claim 11, wherein the 
computer code for monitoring the at least one aspect of the received 
accounting information includes computer code for detecting a scan of a 
plurality of Internet Protocol (CP) addresses. 

16. (Original) The computer program product as recited in claim 1 1 , wherein the 
computer code for monitoring the at least one aspect of the received 
accounting information includes computer code for monitoring a rate of 
receipt of the accounting information. 

1 7. (Original) The computer program product as recited in claim 16, wherein the 
computer code for monitoring the at least one aspect of the received 
accounting information includes computer code for detecting whether the 
rate of receipt of the accounting information exceeds a predetermined 
amount. 



1 8. (Original) The computer program product as recited in claim 1 1 , wherein the 
computer code for monitoring the at least one aspect of the received 
accounting information includes computer code for detecting a scan of a 
plurality of ports. 

1 9. (Original) The computer program product as recited in claim 1 1 , wherein the 
computer code for monitoring the at least one aspect of the received 
accounting information includes computer code for monitoring a load on a 
system receiving the accounting information. 

20. (Previously Amended) A system for processing network accounting 
information, comprising: 

(a) logic for receiving accounting information over a packet-switched network; 

(b) logic for monitoring at least one aspect of the received accounting 
information; and 
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(c) logic for discarding at least a portion of the accounting information that 
occurs during a surge in network traffic, based on the monitored aspect. 

2 1 . (Previously Amended) A method for processing network accounting 
information, comprising: 

(a) receiving accounting information over a packet-switched network; 

(b) monitoring at least one aspect of the received accounting information; and 

(c) conditionally preventing an overload of the accounting information that 
occurs during a surge in network traffic, based on the monitored aspect. 

22. (Previously Amended) A method for processing network accounting 
information, comprising: 

(a) receiving accounting information over a packet-switched network; 

(b) receiving an indication relating to at least one aspect of the received 
accounting information; and 

(c) conditionally preventing an overload of the accounting information that . 
occurs during a surge in network traffic, based on the indication. 

23. (Previously Amended) A method for processing network accounting 
information, comprising: 

(a) receiving accounting information over a packet-switched network; 

(b) detecting a scan of a plurality of ports; 

(c) detecting a scan of a plurality of Internet Protocol (EP) addresses; 

(d) detecting a rate of receipt of the accounting information; 

(e) detecting whether the rate of receipt of the accounting information exceeds a 
predetermined amount; 

(f) detecting a load on a system receiving the accounting information; 

(g) conditionally preventing an overload of the accounting information based on 
aspects detected during steps (b)-(f); and 

(h) generating a summary of the accounting information; 

(i) wherein the accounting infonnation that occurs during a surge in network 
traffic is discarded. 
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